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Amendments to the claims 

Please amend the claims of the instant application as follows: 

1. (Currently amended) A method for tracing a sequence of packets to a potential source thereof 
within a communications network, the sequence of packets being received at a target host in said 
communications network at a received packet rate, the method comprising the steps of: 

fa) identifying a plurality of network elements comprised in said communications network; 

(b) applying a burst load to each of ono or more a selected one of said identified network 
elements in said communications network; 

(c) for each selected network e l e ment, measuring a change in said received packet rate in 
response to said application of said burst load to said selected network element; 

(d) including said selected network element in a potential path if said change in said received 
packet rate fails to meet a predetermined criterion; and 

(e) repeating steps (b). (c) and (d) on other selected network elements a plural number of 
times to generate a path leading from said target host to said potential source based on the selected 
network elements which have been included in said potential path determining said potential sourc e 
of said sequ e nce of packets based on said measured changes in said rec e ived packet rate . 

2. (Original) The method of claim Lwherein said communications network comprises the Internet. 

3. (Original) The method of claim 1 wherein each of said selected network elements comprises a 
network link. 

4. (Original) The method of claim 3 wherein said step of applying a burst load to said network link 
comprises transmitting packets to a subnetwork of said communications network to initiate a 
responsive flow of packets through said network link. 

5. (Original) The method of claim 4 wherein said transmitted packets are spoofed from an end of 
said network link closest to said target host. 
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6. (Original) The method of claim 4 wherein said transmitted packets comprise UDP chargen 
requests. 

7. (Original) The method of claim 1 wherein each of said selected network elements comprises a 
network router. 

8. (Original) The method of claim 1 further comprising the step of generating a map comprising 
routes from said target host to a plurality of subnetworks of said communications network. 

9. (Currently amended) The method of claim 1 further comprising the step of eliminating said 
selected network element from consideration as said potential source of said sequence of packets 
when said change in said received packet rate meets a the predetermined criterion. 

10. (Currently amended) The method of claim 9 I wherein said predetermined criterion comprises a 
determination of whether said change in said received packet rate is less than a predetermined 
threshold. 

11. (Original) The method of claim 9 wherein said step of eliminating said selected network 
element from consideration also eliminates from consideration one or more subnetworks of said 
communications network which are connected to said selected network element. 

12. (Original) The method of claim 1 wherein said sequence of packets comprises a Denial-of- 
Service attack on said target host. 

13. (Original) The method of claim 1 wherein said steps of applying said burst load, measuring said 
changes in said received packet rate, and determining said potential source of said sequence of 
packets, are executed under the control of an automated algorithm. 

14. (Original) The method of claim 1 wherein said steps of applying said burst load and 
determining said potential source of said sequence of packets, are executed under the at least partial 
control of a human operator. 
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15. (Original) The method of claim 14 further comprising the step of displaying information, said 
information including data representative of said measured changes in said received packet rate, to 
said human operator, for use by said human operator in exercising said at least partial control. 

16. (Currently amended) An apparatus for tracing a sequence of packets to a potential source 
thereof within a communications network, the sequence of packets being received at a target host in 
said communications network at a received packet rate, the apparatus comprising: 

(a) means for identifying a plurality of network elements comprised in said communications 
network; 

(b) means for applying a burst load to each of on e or mor e a selected one of said identified 
network elements in said communications network; 

(c) means for measuring changes in said received packet rate in response to said application 
of said burst load to each of said selected network elements; 

fd) means for including said selected network element in a potential path if said change in 
said received packet rate fails to meet a predetermined criterion; and 

(e) means for repeating an operation of means (b), fc) and (d) on other selected network 
elements a plural number of times to generate a path leading from said target host to said potential 
source based on the selected network elements which have been included in said potential path 
means for det e rmining said potential source of said sequ e nc e of pack e ts based on said m e asured 
changes in said received pack e t rat e. 

17. (Original) The apparatus of claim 16 wherein said communications network comprises the 
Internet. 

18. (Original) The apparatus of claim 1 6 wherein each of said selected network elements comprises 
a network link. 

19. (Original) The apparatus of claim 18 wherein said means for applying a burst load to said 
network link comprises means for transmitting packets to a subnetwork of said communications 
network to initiate a responsive flow of packets through said network link. 
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20. (Original) The apparatus of claim 19 wherein said transmitted packets are spoofed from an end 
of said network link closest to said target host. 

21. (Original) The apparatus of claim 19 wherein said transmitted packets comprise UDP chargen 
requests. 

22. (Original) The apparatus of claim 1 6 wherein each of said selected network elements comprises 
a network router. 

23. (Original) The apparatus of claim 16 further comprising means for generating a map comprising 
routes from said target host to a plurality of subnetworks of said communications network. 

24. (Currently amended) The apparatus of claim 16 further comprising means for eliminating said 
selected network element from consideration as said potential source of said sequence of packets 
when said change in said received packet rate meets a the predetermined criterion. 

25. (Currently amended) The apparatus of claim 34 16 wherein said predetermined criterion 
comprises a determination of whether said change in said received packet rate is less than a 
predetermined threshold. 

26. (Original) The apparatus of claim 24 wherein said means for eliminating said selected network 
element from consideration also eliminates from consideration one or more subnetworks of said 
communications network which are connected to said selected network element. 

27. (Original) The apparatus of claim 16 wherein said sequence of packets comprises a Denial-of- 
Service attack on said target host. 

28. (Original) The apparatus of claim 16 wherein said means for applying said burst load, said 
means for measuring said changes in said received packet rate, and said means for determining said 
potential source of said sequence of packets, are executed under the control of an automated 
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algorithm. 

29. (Original) The apparatus of claim 16 wherein said means for applying said burst load and said 
means for determining said potential source of said sequence of packets are executed under the at 
least partial control of a human operator. 

30. (Original) The apparatus of claim 29 further comprising means for displaying information, said 
information including data representative of said measured changes in said received packet rate, to 
said human operator, for use by said human operator in exercising said at least partial control. 
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